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'THE SYSTEM WAS 
BLINKING RED" 



8.1 THE SUMMER OF THREAT 

As 2001 began, counterterrorisni officials were receiving frequent but fragmen- 
tary reports about threats. Indeed, there appeared to be possible threats almost 
everywhere the United States had interests — including at home. 

To understand how the escalation in threat reporting was handled in the 
summer of 2001, it is useful to understand ho^v threat information in general 
is collected and conveyed. Information is collected through several methods, 
including signals intelligence and interviews of human sources, and gathered 
into intelligence reports. Depending on the source and nature of the report- 
ing, these reports may be highly classified — and therefore tightly held — or less 
sensitive and widely disseminated to state and local law enforcement agencies. 
Threat reporting must be disseminated, either through individual reports or 
through threat advisories. Such advisories, intended to alert their recipients, 
may address a specific threat or be a general ^varning. 

Because the amount of reporting is so voluminous, only a select fraction can 
be chosen for briefing the president and senior officials. During 2001, Direc- 
tor of Central Intelligence George Tenet was briefed regularly regarding threats 
and other operational information relating to Usama Bin Ladin.i He in turn 
met daily with President Bush, who was briefed by the CIA through what is 
known as the Presidents Daily Brief (PDB). Each PDB consists of a series of 
six to eight relatively short articles or briefs covering a broad array of topics; 
CIA staff decides \vhich subjects are the most important on any given day. 
There were more than 40 intelligence articles in the PDBs from January 20 
to September 10, 2001, that related to Bin Ladin. The PDB is considered 
highly sensitive and is distributed to only a handful of high-level officials. - 

The Senior Executive Intelligence Brief (SEIB), distributed to a broader 
group of officials, has a similar format and generally covers the same subjects 
as the PDB. It usually contains less information so as to protect sources and 

254 



Final 8-9. 5pp l/ll/OA 1:24 PM Page 2 



^^ 



"THE SYSTEM WAS BLINKING RED" 255 

methods. Like their predecessors, the Attorney General, the FBI Director, and 
Richard Clarke, the National Security Council (NSC) counterterrorism coor- 
dinator, all received the SEIB, not the PDB.^ Clarke and his staff had extensive 
access to terrorism reporting, but they did not have access to internal, nondis- 
seminated information at the National Security Agency (NSA), CIA, or FBI. 

The Drumbeat Begins 

In the spring of 2001, the level of reporting on terrorist threats and planned 
attacks increased dramatically to its highest level since the millennium alert. At 
the end of March, the intelligence community disseminated a terrorist threat 
advisory, indicating a heightened threat of Sunni extremist terrorist attacks 
against U.S. facilities, personnel, and other interests. '^ 

On March 23, in connection with discussions about possibly reopening 
Pennsylvania Avenue in front of the White House, Clarke ^varned National 
Security Advisor Condoleezza Rice that domestic or foreign terrorists might 
use a truck bomb — their "weapon of choice" — on Pennsylvania Avenue. That 
would result, he said, in the destruction of the West Wing and parts of the res- 
idence. ^ He also told her that he thought there were terrorist cells within the 
United States, including al Qaeda. 

The next week. Rice was briefed on the activities of Abu Zubaydah and on 
CIA efforts to locate him. As pointed out in chapter 6, Abu Zubaydah had been 
a major figure in the millennium plots. Over the next fe\v weeks, the CIA repeat- 
edly issued warnings — including calls from DCI Tenet to Clarke — that Abu 
Zubaydah \vas planning an operation in the near future. One report cited a source 
indicating that Abu Zubaydah ^vas planning an attack in a country that CIA ana- 
lysts thought might be Israel, or perhaps Saudi Arabia or India. Clarke relayed 
these reports to Rice.!^ 

In response to these threats, the FBI sent a message to all its field offices on 
April 13, summarizing reporting to date. It asked the offices to task all 
resources, including human sources and electronic databases, for any informa- 
tion pertaining to "current operational activities relating to Sunni extremism." 
It did not suggest that there was a domestic threat.^ 

The interagency Counterterrorism Security Group (CSG) that Clarke 
chaired discussed the Abu Zubaydah reports on April 19. The next day, a brief- 
ing to top officials reported "Bin Ladin planning multiple operations." When 
the deputies discussed al Qaeda policy on April 30, they began ^vith a briefing 
on the threat. 8 

In May 2001, the drumbeat of reporting grew louder with reports to top 
officials that "Bin Ladin public profile may presage attack" and "Bin Ladin net- 
work's plans advancing." In early May, a walk-in to the FBI claimed there was 
a plan to launch attacks on London, Boston, and New York. Attorney General 
John Ashcroft was briefed by the CIA on May 1 5 regarding al Qaeda gener- 
ally and the current threat reporting specifically. The next day brought a report 
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that a phone call to a U.S. embassy had ^varned that Bin Ladin supporters were 
planning an attack in the United States using "high explosives." On May 17, 
based on the previous day's report, the first item on the CSG's agenda was 
"UBL: Operation Planned in U.S.'"' The anonymous caller's tip could not be 
corroborated. 

Late May brought reports of a possible hostage plot against Americans abroad 
to force the release of prisoners, including Sheikh Omar Abdel Rahman, the 
"Blind Sheikh," who was serving a life sentence for his role in the 1993 plot to 
blow up sites in Ne^vYork City. The reporting noted that operatives might opt 
to hijack an aircraft or storm a U.S. embassy This report led to a Federal Avia- 
tion Administration (FAA) information circular to airlines noting the potential 
for "an airline hijacking to free terrorists incarcerated in the United States." 
Other reporting mentioned that Abu Zubaydah was planning an attack, possi- 
bly against Israel, and expected to carry out several more if things went ^vell. 
On May 24 alone, counterterrorism officials grappled with reports alleging plots 
in Yemen and Italy, as well as a report about a cell in Canada that an anonymous 
caller had claimed might be planning an attack against the United States. lo 

Reports similar to many of these were made available to President Bush in 
morning intelligence briefings with DCI Tenet, usually attended by Vice Pres- 
ident Dick Cheney and National Security Advisor Rice. While these briefings 
discussed general threats to attack America and American interests, the specific 
threats mentioned in these briefings were all overseas. 

On May 29, Clarke suggested that Rice ask DCI Tenet what more the 
United States could do to stop Abu Zubaydah from launching"a series of major 
terrorist attacks," probably on Israeli targets, but possibly on U.S. facilities. 
Clarke wrote to Rice and her deputy, Stephen Hadley, "When these attacks 
occur, as they likely ^vill, we will ^vonder ^vhat more we could have done to 
stop them." In May, CIA Counterterrorist Center (CTC) Chief Cofer Black 
told Rice that the current threat level was a 7 on a scale of 1 to 10, as com- 
pared to an 8 during the millennium. ^^ 

High Probability of Near- Term "Spectacular" Attacks 

Threat reports surged in June and July, reaching an even higher peak of urgency. 
The summer threats seemed to be focused on Saudi Arabia, Israel, Bahrain, 
Kuwait, Yemen, and possibly Rome, but the danger could be any^vhere — 
including a possible attack on the G-8 summit in Genoa. A June 12 CIA report 
passing along biographical background information on several terrorists men- 
tioned, in commenting on Khalid Sheikh Mohammed, that he was recruiting 
people to travel to the United States to meet with colleagues already there so 
that they might conduct terrorist attacks on Bin Ladin 's behalf. On June 22, 
the CIA notified all its station chiefs about intelligence suggesting a possible 
al Qaeda suicide attack on a U.S. target over the next fe^v days. DCI Tenet asked 
that all U.S. ambassadors be briefed. '^ 
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That same day, the State Department notified all embassies of the terrorist 
threat and updated its worldwide public warning. In June, the State Depart- 
ment initiated the Visa Express program in Saudi Arabia as a security measure, 
in order to keep long lines of foreigners away from vulnerable embassy spaces. 
The program permitted visa applications to be made through travel agencies, 
instead of directly at the embassy or consulate. ^-^ 

A terrorist threat advisory distributed in late June indicated a high proba- 
bility of near-term "spectacular" terrorist attacks resulting in numerous casu- 
alties. Other reports' titles warned, "Bin Ladin Attacks May be Imminent" and 
"Bin Ladin and Associates Making Near- Term Threats." The latter reported 
multiple attacks planned over the coming days, including a "severe blow" 
against U.S. and Israeli "interests" during the next two weeks. ^^ 

On June 21 , near the height of the threat reporting, U.S. Central Command 
raised the force protection condition level for U.S. troops in six countries to 
the highest possible level. Delta. The U.S. Fifth Fleet moved out of its port in 
Bahrain, and a U.S. Marine Corps exercise in Jordan was halted. U.S. embassies 
in the Persian Gulf conducted an emergency security review, and the embassy 
in Yemen was closed. The CSG had foreign emergency response teams, known 
as FESTs, ready to move on four hours' notice and kept up the terrorism alert 
posture on a "rolling 24 hour basis.''^^ 

On June 25, Clarke warned Rice and Hadley that six separate intelligence 
reports showed al Qaeda personnel warning of a pending attack. An Arabic tel- 
evision station reported Bin Ladin 's pleasure \vith al Qaeda leaders who were 
saying that the next weeks "will witness important surprises" and that U.S. and 
Israeli interests will be targeted. Al Qaeda also released a ne^v recruitment and 
fund-raising tape. Clarke wrote that this was all too sophisticated to be merely 
a psychological operation to keep the United States on edge, and the CIA 
agreed. The intelligence reporting consistently described the upcoming attacks 
as occurring on a calamitous level, indicating that they would cause the world 
to be in turmoil and that they would consist of possible multiple — but not nec- 
essarily simultaneous — attacks. ^"^ 

On June 28, Clarke wrote Rice that the pattern of al Qaeda activity indi- 
cating attack planning over the past six weeks "had reached a crescendo." "A 
series of new reports continue to convince me and analysts at State, CIA, DIA 
[Defense Intelligence Agency], and NSA that a major terrorist attack or series 
of attacks is likely in July," he noted. One al Qaeda intelligence report warned 
that something "very, very, very, very" big was about to happen, and most of 
Bin Ladin 's network was reportedly anticipating the attack. In late June, the 
CIA ordered all its station chiefs to share information on al Qaeda with their 
host governments and to push for immediate disruptions of cells. ^^ 

The headline of a June 30 briefing to top officials ^vas stark:"Bin Ladin Plan- 
ning High-Profile Attacks." The report stated that Bin Ladin operatives 
expected near-term attacks to have dramatic consequences of catastrophic pro- 
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portions. That same day, Saudi Arabia declared its highest level of terror alert. 
Despite evidence of delays possibly caused by heightened U.S. security, the 
planning for attacks was continuing.!^ 

On July 2, the FBI Counterterrorisni Division sent a message to federal 
agencies and state and local law enforcement agencies summarizing informa- 
tion regarding threats from Bin Ladin. It warned that there was an increased 
volume of threat reporting, indicating a potential for attacks against U.S. tar- 
gets abroad from groups "aligned with or sympathetic to Usama Bin Ladin." 
Despite the general warnings, the message further stated, "The FBI has no 
information indicating a credible threat of terrorist attack in the United States." 
However, it went on to emphasize that the possibility of attack in the United 
States could not be discounted. It also noted that the July 4 holiday might 
heighten the threats. The report asked recipients to "exercise extreme vigilance" 
and "report suspicious activities" to the FBI. It did not suggest specific actions 
that they should take to prevent attacks. ^^ 

Disruption operations against al Qaeda— affiliated cells were launched 
involving 20 countries. Several terrorist operatives were detained by foreign 
governments, possibly disrupting operations in the Gulf and Italy and perhaps 
averting attacks against t^vo or three U.S. embassies. Clarke and others told us 
of a particular concern about possible attacks on the Fourth of July. After it 
passed uneventfully, the CSG decided to maintain the alert. -'^ 

To enlist more international help,Vice President Cheney contacted Saudi 
Crown Prince Abdullah on July 5. Hadley apparently called European coun- 
terparts, while Clarke worked ^vith senior officials in the Gulf. In late July, 
because of threats, Italy closed the airspace over Genoa and mounted antiair- 
craft batteries at the Genoa airport during the G-8 summit, which President 
Bush attended. 21 

At home, the CSG arranged for the CIA to brief intelligence and security 
officials from several domestic agencies. On July 5, representatives from the 
Immigration and Naturalization Service (INS), the FAA, the Coast Guard, the 
Secret Service, Customs, the CIA, and the FBI met with Clarke to discuss the 
current threat. Attendees report that they were told not to disseminate the 
threat information they received at the meeting. They interpreted this direc- 
tion to mean that although they could brief their superiors, they could not send 
out advisories to the field. An NSC official recalls a somewhat different empha- 
sis, saying that attendees \vere asked to take the information back to their home 
agencies and "do what you can" with it, subject to classification and distribu- 
tion restrictions. A representative from the INS asked for a summary of the 
information that she could share with field offices. She never received one.22 

That same day, the CIA briefed Attorney General Ashcroft on the al Qaeda 
threat, warning that a significant terrorist attack was imminent. Ashcroft was 
told that preparations for multiple attacks were in late stages or already com- 
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plete and that little additional warning could be expected. The briefing 
addressed only threats outside the United States. ^3 

The next day, the CIA representative told the CSG that al Qaeda members 
believed the upcoming attack \vould be "spectacular," qualitatively diflierent 
fi-om anything they had done to date.-^ 

Apparently as a result of the July 5 meeting with Clarke, the interagency 
committee on federal building security was tasked to examine security meas- 
ures. This committee met on July 9, ^vhen 37 officials from 27 agencies and 
organizations were briefed on the "current threat level" in the United States. 
They \vere told that not only the threat reports from abroad but also the recent 
convictions in the East Africa bombings trial, the conviction of Ahmed 
Ressani, and the just-returned Khobar Towers indictments reinforced the need 
to "exercise extreme vigilance." Attendees were expected to determine 
whether their respective agencies needed enhanced security measures. -^ 

On July 18, 2001, the State Department provided a warning to the public 
regarding possible terrorist attacks in the Arabian Peninsula. -^ 

Acting FBI DirectorThomas Pickard told us he had one of his periodic con- 
ference calls with all special agents in charge on July 19. He said one of the 
items he mentioned was the need, in light of increased threat reporting, to have 
evidence response teams ready to move at a moment's notice, in case of an 
attack. 2'' He did not task field offices to try to determine ^vhether any plots 
were being considered within the United States or to take any action to dis- 
rupt any such plots. 

In mid-July, reporting started to indicate that Bin Ladin's plans had been 
delayed, maybe for as long as two months, but not abandoned. On July 23, the 
lead item for CSG discussion was still the al Qaeda threat, and it included men- 
tion of suspected terrorist travel to the United States. ^^ 

On July 31, an FAA circular appeared alerting the aviation community to 
"reports of possible near-term terrorist operations . . . particularly on the Ara- 
bian Peninsula and/or Israel." It stated that the FAA had no credible evidence 
of specific plans to attack U.S. civil aviation, though it noted that some of the 
"currently active" terrorist groups were known to "plan and train for hijack- 
ings" and were able to build and conceal sophisticated explosive devices in lug- 
gage and consumer products. ^9 

Tenet told us that in his world "the system was blinking red." By late July, 
Tenet said, it could not "get any worse."-'" Not everyone ^vas convinced. Some 
asked whether all these threats might just be deception. On June 30, the SEIB 
contained an article titled "Bin Ladin Threats Are Real." Yet Hadley told Tenet 
in July that Deputy Secretary of Defense PaulWolfowitz questioned the report- 
ing. Perhaps Bin Ladin was trying to study U.S. reactions. Tenet replied that he 
had already addressed the Defense Department's questions on this point; the 
reporting was convincing. To give a sense of his anxiety at the time, one senior 
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official in the Counterterrorist Center told us that he and a colleague were con- 
sidering resigning in order to go public -with their concerns. ^^ 

The Calm Before the Storm 

On July 27, Clarke informed Rice and Hadley that the spike in intelligence 
about a near-term al Qaeda attack had stopped. He urged keeping readiness 
high during the August vacation period, warning that another report suggested 
an attack had just been postponed for a few months "but wiU still happen."^^ 

On August 1, the FBI issued an advisory that in light of the increased vol- 
ume of threat reporting and the upcoming anniversary of the East Africa 
embassy bombings, increased attention should be paid to security planning. It 
noted that although most of the reporting indicated a potential for attacks on 
U.S. interests abroad, the possibility of an attack in the United States could not 
be discounted. ^-^ 

On August 3, the intelligence community issued an advisory concluding 
that the threat of impending al Qaeda attacks would likely continue indefi- 
nitely. Citing threats in the Arabian Peninsula, Jordan, Israel, and Europe, the 
advisory suggested that al Qaeda ^vas lying in wait and searching for gaps in 
security before moving forward with the planned attacks. ^^^ 

During the spring and summer of 2001, President Bush had on several occa- 
sions asked his briefers whether any of the threats pointed to the United States. 
Reflecting on these questions, the CIA decided to write a briefing article sum- 
marizing its understanding of this danger. Two CIA analysts involved in prepar- 
ing this briefing article believed it represented an opportunity to communicate 
their view that the threat of a Bin Ladin attack in the United States remained 
both current and serious. ^5 The result was an article in the August 6 Presiden- 
tial Daily Brief titled "Bin Ladin Determined to Strike in US." It was the 36th 
PDB item briefed so far that year that related to Bin Ladin or al Qaeda, and 
the first devoted to the possibility of an attack in the United States. 

The President told us the August 6 report ^vas historical in nature. President 
Bush said the article told him that al Qaeda ^vas dangerous, which he said he 
had known since he had become President. The President said Bin Ladin had 
long been talking about his desire to attack America. He recalled some oper- 
ational data on the FBI, and remembered thinking it was heartening that 70 
investigations were under way. As best he could recollect. Rice had mentioned 
that the Yemenis' surveillance of a federal building in New York had been 
looked into in May and June, but there was no actionable intelligence. 

He did not recall discussing the August 6 report ^vith the Attorney General 
or whether Rice had done so. He said that if his advisers had told him there 
was a cell in the United States, they would have moved to take care of it. That 
never happened. ^^ 

Although the following day's SEIB repeated the title of this PDB, it did not 
contain the reference to hijackings, the alert in New York, the aUeged casing 
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The following is the text of an item from the Presidential Daily Brief received by 
President George W Bush on August 6, 2001J'' Redacted material is indicated 
by brackets. 

Bin Ladin Determined To Strike in US 

Clandestine, foreign government, and media reports indicate Bin Ladin 
since 1997 has wanted to conduct terrorist attacks in the US. Bin Ladin 
implied in US television interviews in 1997 and 1998 that his followers 
would follow the example of World Trade Center bomber RamziYousef 
and "bring the fighting to America." 

After US missile strikes on his base in Afghanistan in 1998, Bin 
Ladin told followers he wanted to retaliate in Washington, accord- 
ing to a [ — ] service. 

An Egyptian Islamic Jihad (EIJ) operative told an [ — ] service 
at the same time that Bin Ladin was planning to exploit the oper- 
ative's access to the US to mount a terrorist strike. 

The millennium plotting in Canada in 1999 may have been part of Bin 
Ladin 's first serious attempt to implement a terrorist strike in the US. 

Convicted plotter Ahmed Ressam has told the FBI that he conceived 
the idea to attack Los Angeles International Airport himself, but that Bin 
Ladin lieutenant Abu Zubaydah encouraged him and helped facilitate 
the operation. Ressam also said that in 1998 Abu Zubaydah was plan- 
ning his own US attack. 

Ressam says Bin Ladin was aware of the Los Angeles operation. 

Although Bin Ladin has not succeeded, his attacks against the US 
Embassies in Kenya and Tanzania in 1998 demonstrate that he prepares 
operations years in advance and is not deterred by setbacks. Bin Ladin 
associates surveilled our Embassies in Nairobi and Dar es Salaam as early 
as 1993, and some members of the Nairobi cell planning the bombings 
were arrested and deported in 1997. 

Al-Qa'ida members — including some who are US citizens — have resided 
in or traveled to the US for years, and the group apparently maintains a 
support structure that could aid attacks. Two al-Qua' da members found 
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guilty in the conspiracy to bomb our embassies in East Africa were US 
citizens, and a senior EIJ member lived in California in the mid-1990s. 

A clandestine source said in 1998 that a Bin Ladin cell in New York 
was recruiting Muslim-American youth for attacks. 

We have not been able to corroborate some of the more sensational threat 
reporting, such as that from a [ — ] service in 1998 saying that Bin Ladin 
wanted to hijack a US aircraft to gain the release of "Blind Shaykh" 
'Umar 'Abd al-Rahman and other US-held extremists. 

Nevertheless, FBI information since that time indicates patterns of 
suspicious activity in this country consistent with preparations for 
hijackings or other types of attacks, including recent surveillance of 
federal buildings in New York. 

The FBI is conducting approximately 70 full field investigations 
throughout the US that it considers Bin Ladin-related. CIA and 
the FBI are investigating a call to our Embassy in the UAE in May 
saying that a group of Bin Ladin supporters was in the US plan- 
ning attacks with explosives. 



of buildings in New York, the threat phoned in to the embassy, or the fact that 
the FBI had approximately 70 ongoing bin Ladin— related investigations. ^^ No 
CSG or other NSC meeting was held to discuss the possible threat of a strike 
in the United States as a result of this report. 

Late in the month, a foreign service reported that Abu Zubaydah was con- 
sidering mounting terrorist attacks in the United States, after postponing pos- 
sible operations in Europe. No targets, timing, or method of attack were 
provided. 39 

We have found no indication of any further discussion before September 
11 among the President and his top advisers of the possibility of a threat of an 
al Qaeda attack in the United States. DCI Tenet visited President Bush in 
Crawford, Texas, on August 17 and participated in PDB briefings of the Pres- 
ident between August 31 (after the President had returned to Washington) and 
September 10. But Tenet does not recall any discussions with the President of 
the domestic threat during this period.^o 

Most of the intelligence community recognized in the summer of 2001 that 
the number and severity of threat reports were unprecedented. Many ofliicials 
told us that they knew something terrible was planned, and they were desper- 
ate to stop it. Despite their large number, the threats received contained few 
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specifics regarding time, place, method, or target. Most suggested that attacks 
were planned against targets overseas; others indicated threats against unspeci- 
fied "U.S. interests." We cannot say for certain whether these reports, as dra- 
matic as they ^vere, related to the 9/11 attacks. 

Government Response to the Threats 

National Security Advisor Rice told us that the CSG was the "nerve center" 
for running the crisis, although other senior officials were involved over the 
course of the summer. In addition to his daily meetings with President Bush, 
and weekly meetings to go over other issues \vith Rice,Tenet was speaking reg- 
ularly ^vith Secretary of State Colin Powell and Secretary of Defense Donald 
Rumsfeld. The foreign policy principals routinely talked on the telephone 
every day on a variety of topics. '*i 

Hadley told us that before 9/1 1, he and Rice did not feel they had the job 
of coordinating domestic agencies. They felt that Clarke and the CSG (part of 
the NSC) were the NSC's bridge between foreign and domestic threats. ^^^ 

There was a clear disparity in the levels of response to foreign versus domes- 
tic threats. Numerous actions were taken overseas to disrupt possible attacks — 
enlisting foreign partners to upset terrorist plans, closing embassies, moving 
military assets out of the way of possible harm. Far less was done domestically — 
in part, surely, because to the extent that specifics did exist, they pertained to 
threats overseas. As noted earlier, a threat against the embassy in Yemen quickly 
resulted in its closing. Possible domestic threats were more vague. When reports 
did not specify where the attacks were to take place, officials presumed that they 
would again be overseas, though they did not rule out a target in the United 
States. Each of the FBI threat advisories made this point. ^^^ 

Clarke mentioned to National Security Advisor Rice at least t^vice that al 
Qaeda sleeper cells were likely in the United States. In January 2001, Clarke 
forwarded a strategy paper to Rice warning that al Qaeda had a presence in 
the United States. He noted that t^vo key al Qaeda members in the Jordanian 
cell involved in the millennium plot were naturalized U.S. citizens and that one 
jihadist suspected in the East Africa bombings had "informed the FBI that an 
extensive network of al Qida 'sleeper agents' currently exists in the US." He 
added that Ressam's abortive December 1999 attack revealed al Qaeda sup- 
porters in the United States. '^'^ His analysis, however, was based not on new 
threat reporting but on past experience. 

The September 1 1 attacks fell into the void between the foreign and domes- 
tic threats. The foreign intelligence agencies were watching overseas, alert to 
foreign threats to U.S. interests there. The domestic agencies were waiting for 
evidence of a domestic threat from sleeper cells within the United States. No 
one was looking for a foreign threat to domestic targets. The threat that was 
coming was not from sleeper cells. It was foreign — but from foreigners who 
had infiltrated into the United States. 
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A second cause of this disparity in response is that domestic agencies did 
not know ^vhat to do, and no one gave them direction. Cressey told us that the 
CSG did not tell the agencies ho\¥ to respond to the threats. He noted that the 
agencies that were operating overseas did not need direction on how to 
respond; they had experience ^vith such threats and had a"playbook." In con- 
trast, the domestic agencies did not have a game plan. Neither the NSC (includ- 
ing the CSG) nor anyone else instructed them to create one.'^s 

This lack of direction was evident in the July 5 meeting with representa- 
tives from the domestic agencies. The briefing focused on overseas threats. The 
domestic agencies were not questioned about how they planned to address the 
threat and were not told what was expected of them. Indeed, as noted earlier, 
they were specifically told they could not issue advisories based on the brief- 
ing.'** The domestic agencies' limited response indicates that they did not per- 
ceive a call to action. 

Clarke reflected a different perspective in an email to Rice on September 
15, 2001. He summarized the steps taken by the CSG to alert domestic agen- 
cies to the possibility of an attack in the United States. Clarke concluded that 
domestic agencies, including the FAA, kne^v that the CSG believed a major al 
Qaeda attack was coming and could be in the United States. 

Although the FAA had authority to issue security directives mandating new 
security procedures, none of the fe\v that ^vere released during the summer of 
2001 increased security at checkpoints or on board aircraft. The information 
circulars mostly urged air carriers to "exercise prudence" and be alert. Prior to 
9/11, the FAA did present a CD-ROM to air carriers and airport authorities 
describing the increased threat to civil aviation. The presentation mentioned 
the possibility of suicide hijackings but said that "fortunately, we have no indi- 
cation that any group is currently thinking in that direction." '^^ The FAA con- 
ducted 27 special security briefings for specific air carriers bet^veen May 1, 
2001, and September 11, 2001. Two of these briefings discussed the hijacking 
threat overseas. None discussed the possibility of suicide hijackings or the use 
of aircraft as weapons. No new security measures were instituted. '*8 

Rice told us she understood that the FBI had tasked its 56 U.S. field offices 
to increase surveillance of suspected terrorists and to reach out to informants 
who might have information about terrorist plots. An NSC staff document at 
the time describes such a tasking as having occurred in late June but does not 
indicate whether it ^vas generated by the NSC or the FBI. Other than the pre- 
viously described April 13 communication sent to all FBI field offices, how- 
ever, the FBI could not find any record of having received such a directive.The 
April 13 document asking field offices to gather information on Sunni 
extremism did not mention any possible threat within the United States and 
did not order surveillance of suspected operatives. The NSC did not specify 
what the FBI's directives should contain and did not review what had been 
issued earlier. 49 
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Acting FBI Director Pickard told us that in addition to his July 19 confer- 
ence call, he mentioned the heightened terrorist threat in individual calls ^vith 
the special agents in charge of field offices during their annual performance 
revie\v discussions. In speaking -with agents around the country, ^ve found lit- 
tle evidence that any such concerns had reached FBI personnel beyond the 
New York Field Office, ^o 

The head of counterterrorism at the FBI, Dale Watson, said he had many 
discussions about possible attacks with Cofer Black at the CIA. They had 
expected an attack on July 4. Watson said he felt deeply that something was 
going to happen. But he told us the threat information was "nebulous." He 
wished he had kno^vn more. He wished he had had "500 analysts looking at 
Usama Bin Ladin threat information instead of two."^^ 

Attorney General Ashcroft was briefed by the CIA in May and by Pickard 
in early July about the danger. Pickard said he met with Ashcroft once a week 
in late June, through July, and twice in August. There is a dispute regarding 
Ashcrofts interest in Pickard's briefings about the terrorist threat situation. 
Pickard told us that after two such briefings Ashcroft told him that he did not 
want to hear about the threats anymore. Ashcroft denies Pickard's charge. 
Pickard says he continued to present terrorism information during further 
briefings that summer, but nothing further on the "chatter" the U.S. govern- 
ment was receiving. 5- 

The Attorney General told us he asked Pickard ^vhether there was intelli- 
gence about attacks in the United States and that Pickard said no. Pickard said 
he replied that he could not assure Ashcroft that there would be no attacks in 
the United States, although the reports of threats were related to overseas tar- 
gets. Ashcroft said he therefore assumed the FBI ^vas doing what it needed to 
do. He acknowledged that in retrospect, this was a dangerous assumption. He 
did not ask the FBI ^vhat it was doing in response to the threats and did not 
task it to take any specific action. He also did not direct the INS, then still part 
of the Department of Justice, to take any specific action. ^^ 

In sum, the domestic agencies never mobilized in response to the threat. 
They did not have direction, and did not have a plan to institute. The borders 
were not hardened. Transportation systems were not fortified. Electronic sur- 
veillance was not targeted against a domestic threat. ^^ State and local law 
enforcement \vere not marshaled to augment the FBI's efforts. The public was 
not warned. 

The terrorists exploited deep institutional failings within our government. 
The question is whether extra vigilance might have turned up an opportu- 
nity to disrupt the plot. As seen in chapter 7, al Qaeda's operatives made nfis- 
takes. At least two such nnstakes created opportunities during 2001, especially 
in late August. 
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8.2 LATE LEADS— MIHDHAR,MOUSSAOUI, AND KSM 

In chapter 6 we discussed how intelligence agencies successfully detected some 
of the early travel in the planes operation, picking up the movements of Khalid 
al Mihdhar and identifying him, and seeing his travel converge ^vith someone 
they perhaps could have identified but did not — Nawaf al Hazmi — as well as with 
less easily identifiable people such as Khallad and Abu Bara. These observations 
occurred in December 1999 and January 2000. The trail had been lost in Janu- 
ary 2000 \vithout a clear realization that it had been lost, and without much effort 
to pick it up again. Nor had the CIA placed Mihdhar on the State Department's 
watchlist for suspected terrorists, so that either an embassy or a port of entry 
might take note if Mihdhar showed up again. 

On four occasions in 2001, the CIA, the FBI, or both had apparent oppor- 
tunities to refocus on the significance of Hazmi and Mihdhar and reinvigorate 
the search for them. After reviewing those episodes we ^vill turn to the han- 
dling of the Moussaoui case and some late leads regarding Khalid Sheikh 
Mohammed. 

January 2001: Identification of Khallad 

Almost one year after the original trail had been lost in Bangkok, the FBI and 
the CIA were working on the investigation of the Cole bombing. They learned 
of the link between a captured conspirator and a person called "Khallad."They 
also learned that Khallad was a senior security official for Bin Ladin who had 
helped direct the bombing (we introduced Khallad in chapter 5, and returned 
to his role in the Cole bombing in chapter 6).55 

One of the members of the FBI's investigative team in Yemen realized that 
he had heard of Khallad before, from a joint FBI/CIA source four months ear- 
lier.The FBI agent obtained from a foreign government a photo of the person 
believed to have directed the Cole bombing. It ^vas shown to the source, and 
he confirmed that the man in that photograph ^vas the same Khallad he had 
described. 5'^ 

In December 2000, on the basis of some links associated with Khalid al 
Mihdhar, the CIA's Bin Ladin unit speculated that Khallad and Khalid al Mihd- 
har might be one and the same.^^ 

The CIA asked that a Kuala Lumpur surveillance photo of Mihdhar be 
sho^vn to the joint source who had identified Khallad. In early January 2001, 
two photographs from the Kuala Lumpur meeting were shown to the source. 
One ^vas a known photograph of Mihdhar, the other a photograph of a then 
unkno\vn subject. The source did not recognize Mihdhar. But he indicated he 
was 90 percent certain that the other individual was Khallad. ^^ 

This meant that Khallad and Mihdhar were two different people. It also 
meant that there was a link between Khallad and Mihdhar, making Mihdhar 
seem even more suspicious. ^^ Yet we found no effort by the CIA to renew the 
long-abandoned search for Mihdhar or his travel companions. 
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In addition, we found that the CIA did not notify the FBI of this identifi- 
cation. DCI Tenet and Cofer Black testified before Congress's Joint Inquiry into 
9/11 that the FBI had access to this identification from the beginning. But 
drawing on an extensive record, including documents that were not available 
to the CIA personnel ^vho drafted that testimony, ^ve conclude this was not 
the case.The FBI's primary Cole investigators had no kno^vledge that Khallad 
had been in Kuala Lumpur with Mihdhar and others until after the Septem- 
ber 11 attacks. Because the FBI had not been informed in January 2000 about 
Mihdhar's possession of a U.S. visa, it had not then started looking for him in 
the United States. Because it did not kno^v of the links between Khallad and 
Mihdhar, it did not start looking for him in January 2001. *" 

This incident is an example of ho^v day-to-day gaps in information sharing 
can emerge even when there is mutual good^vill.The information was from a 
joint FBI/CIA source who spoke essentially no English and whose languages 
were not understood by the FBI agent on the scene overseas. Issues of travel 
and security necessarily kept short the amount of time spent with the source. 
As a result, the CIA officer usually did not translate either questions or answers 
for his FBI colleague and friend. "^^ 

For interviews without simultaneous translation, the FBI agent on the scene 
received copies of the reports that the CIA disseminated to other agencies 
regarding the interviews. But he was not given access to the CIA's internal 
operational reports, which contained more detail. It was there — in reporting 
to ^vhich FBI investigators did not have access — that information regarding the 
January 2001 identification of Khallad appeared.The CIA officer does not recall 
this particular identification and thus cannot say why it was not shared ^vith 
his FBI colleague. He might not have understood the possible significance of 
the new identification. "^^ 

In June 2000, Mihdhar left California and returned to Yemen. It is possible 
that if, in January 2001, the CIA had resumed its search for him, placed him 
on the State Department's TIPOFF watchlist, or provided the FBI with the 
information, he might have been found — either before or at the time he 
applied for a new visa in June 2001, or when he returned to the United States 
on July 4. 

Spring 2001: Looking Again at Kuala Lumpur 

By mid-May 2001, as the threat reports were surging, a CIA official detailed 
to the International Terrorism Operations Section at the FBI wondered where 
the attacks might occur. We will call him "John." Recalling the episode about 
the Kuala Lumpur travel of Mihdhar and his associates, "John" searched the 
CIA's databases for information regarding the travel. On May 15, he and an 
official at the CIA reexamined many of the old cables from early 2000, includ- 
ing the information that Mihdhar had a U.S. visa, and that Hazmi had come 
to Los Angeles on January 15, 2000. *3 

The CIA official ^vho reviewed the cables took no action regarding them. 
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"John," however, began a lengthy exchange with a CIA analyst, ^vhonl we -will 
call "Dave," to figure out what these cables meant. "John" was aware of how 
dangerous Khallad was — at one point calling him a "major league killer." He 
concluded that "something bad was definitely up." Despite the U.S. links evi- 
dent in this traffic, "John" made no effort to determine whether any of these 
individuals was in the United States. He did not raise that possibility with his 
FBI counterpart. He was focused on Malaysia. <^'* 

"John" described the CIA as an agency that tended to play a "zone defense." 
He was worrying solely about Southeast Asia, not the United States. In con- 
trast, he told us, the FBI tends to play "man-to-nian."'^^ 

Desk officers at the CIA's Bin Ladin unit did not have "cases" in the same 
sense as an FBI agent who works an investigation from beginning to end. Thus, 
when the trail went cold after the Kuala Lumpur meeting in January 2000, the 
desk officer moved on to different things. By the time the March 2000 cable 
arrived with information that one of the travelers had flown to Los Angeles, 
the case officer was no longer responsible for follow-up. While several individ- 
uals at the Bin Ladin unit opened the cable when it arrived in March 2000, no 
action was taken, i^* 

The CIA's zone defense concentrated on "where," not "who." Had its infor- 
mation been shared with the FBI, a combination of the CIA's zone defense 
and the FBI's man-to-man approach might have been productive. 

June 2001: The Meeting in New York 

"John's" review of the Kuala Lumpur meeting did set off some more shar- 
ing of information, getting the attention of an FBI analyst whom we will call 
"Jane." "Jane" was assigned to the FBI's Cole investigation. She knew that 
another terrorist involved in that operation, Fahd al Quso, had traveled to 
Bangkok in January 2000 to give money to Khallad.*^ 

"Jane" and the CIA analyst, "Dave," had been working together on Cole- 
related issues. Chasing Quso's trail, "Dave" suggested showing some photo- 
graphs to FBI agents in New York who were working on the Cole case and had 
interviewed Quso.!^* 

"John" gave three Kuala Lumpur surveillance pictures to "Jane" to show to 
the New York agents. She was told that one of the individuals in the photo- 
graphs was someone named Khalid al Mihdhar. She did not know why the 
photographs had been taken or why the Kuala Lumpur travel might be signif- 
icant, and she was not told that someone had identified Khallad in the photo- 
graphs. When "Jane" did some research in a database for intelligence reports, 
Intelink, she found the original NSA reports on the planning for the meeting. 
Because the CIA had not disseminated reports on its tracking of Mihdhar, 
"Jane" did not puU up any information about Mihdhar's U.S. visa or about travel 
to the United States by Hazmi or Mihdhar. ^^ 

"Jane," "Dave," and an FBI analyst who was on detail to the CIA's Bin Ladin 
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unit went to New York on June 11 to meet \¥ith the agents about the Cole case. 
"Jane" brought the surveillance pictures. At some point in the meeting she 
shoAved the photographs to the agents and asked ^vhether they recognized 
Quso in any of them. The agents asked questions about the photographs — 
Why -were they taken? Why -were these people being followed? Where are the 
rest of the photographs?^'^ 

The only information "Jane" had about the meeting — other than the pho- 
tographs — ^were the NSA reports that she had found on Intelink. These reports, 
however, contained caveats that their contents could not be shared with crim- 
inal investigators \vithout the permission of the Justice Department's Office of 
Intelligence Policy and Review (OIPR). Therefore "Jane" concluded that she 
could not pass on information from those reports to the agents. This decision 
was potentially significant, because the signals intelligence she did not share 
linked Mihdhar to a suspected terrorist facility in the Middle East. The agents 
would have established a link to the suspected facility from their work on the 
embassy bombings case. This link would have made them very interested in 
learning more about Mihdhar.^i The sad irony is that the agents who found 
the source were being kept from obtaining the fruits of their own work. 

"Dave," the CIA analyst, knew more about the Kuala Lumpur meeting. He 
knew that Mihdhar possessed a U.S. visa, that his visa application indicated that 
he intended to travel to Ne^v York, that Hazmi had traveled to Los Angeles, 
and that a source had put Mihdhar in the company of Khallad. No one at the 
meeting asked him what he knew; he did not volunteer anything. He told 
investigators that as a CIA analyst, he was not authorized to answer FBI ques- 
tions regarding CIA information. "Jane" said she assumed that if "Dave" knew 
the answers to questions, he would have volunteered them. The New York 
agents left the meeting without obtaining information that might have started 
them looking for Mihdhar.^- 

Mihdhar had been a weak link in al Qaeda's operational planning. He had 
left the United States in June 2000, a mistake KSM realized could endanger 
the entire plan — for to continue with the operation, Mihdhar would have to 
travel to the United States again. And unlike other operatives, Mihdhar was not 
"clean": he had jihadist connections. It was just such connections that had 
brought him to the attention of U.S. ofliicials. 

Nevertheless, in this case KSM's fears were not realized. Mihdhar received 
a new U.S. visa two days after the CIA-FBI meeting in New York. He flew 
to New York City on July 4. No one was looking for him. 

August 2001: The Search for Mihdhar and Hazmi Begins and Fails 

During the summer of 2001 "John," follo^ving a good instinct but not as part 
of any formal assignment, asked "Mary," an FBI analyst detailed to the CIA's 
Bin Ladin unit, to review all the Kuala Lumpur materials one more time. She 
had been at the New York meeting with "Jane" and "Dave" but had not 
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looked into the issues yet herself. "John" asked her to do the research in her 
free tinieJ^ 

"Mary" began her -work on July 24. That day, she found the cable reporting 
that Mihdhar had a visa to the United States. A week later, she found the cable 
reporting that Mihdhar 's visa application — what was later discovered to be his 
first application — listed New York as his destination. On August 21, she 
located the March 2000 cable that "noted with interest" that Haznii had flown 
to Los Angeles in January 2000. She immediately grasped the significance of 
this information. ^4 

"Mary" and "Jane" promptly met with an INS representative at FBI head- 
quarters. On August 22, the INS told them that Mihdhar had entered the 
United States on January 15, 2000, and again on July 4, 2001. "Jane" and 
"Mary" also learned that there was no record that Hazmi had left the coun- 
try since January 2000, and they assumed he had left with Mihdhar in June 
2000. They decided that if Mihdhar was in the United States, he should be 
found. ^5 

They divided up the work. "Mary" asked the Bin Ladin unit to draft a cable 
requesting that Mihdhar and Hazmi be put on the TIPOFF watchlist. Both 
Hazmi and Mihdhar were added to this watchlist on August 24. ^^ 

"Jane" took responsibility for the search effort inside the United States. As 
the information indicated that Mihdhar had last arrived in New York, she began 
drafting what is known as a lead for the FBI's New York Field Office. A lead 
relays information from one part of the FBI to another and requests that a par- 
ticular action be taken. She called an agent in New York to give him a "heads- 
up" on the matter, but her draft lead was not sent until August 28. Her email 
told the New York agent that she wanted him to get started as soon as possi- 
ble, but she labeled the lead as "Routine" — a designation that informs the 
receiving office that it has 30 days to respond. ^^ 

The agent who received the lead forwarded it to his squad supervisor. That 
same day, the supervisor forwarded the lead to an intelligence agent to open 
an intelligence case — an agent who thus was behind "the wall" keeping FBI 
inteUigence information from being shared with criminal prosecutors. He also 
sent it to the Cole case agents and an agent who had spent significant time in 
Malaysia searching for another Khalid: Khalid Sheikh Mohammad. ^^ 

The suggested goal of the investigation was to locate Mihdhar, determine 
his contacts and reasons for being in the United States, and possibly conduct 
an interview. Before sending the lead, "Jane" had discussed it with "John," the 
CIA official on detail to the FBI. She had also checked with the acting head 
of the FBI's Bin Ladin unit. The discussion seems to have been limited to 
whether the search should be classified as an intelligence investigation or as a 
criminal one. It appears that no one informed higher levels of management in 
either the FBI or CIA about the case.^' There is no evidence that the lead, or 
the search for these terrorist suspects, was substantively discussed at any level 



Final 8-9. 5pp l/ll/OA 1:24 PM Page 2 



l^ 



"THE SYSTEM WAS BLINKING RED" 271 

above deputy chief of a section within the Counterterrorisni Division at FBI 
headquarters. 

One of the Cole case agents read the lead with interest, and contacted "Jane" 
to obtain more information. "Jane" argued, however, that because the agent was 
designated a "criminal" FBI agent, not an intelligence FBI agent, the wall kept 
him from participating in any search for Mihdhar. In fact, she felt he had to 
destroy his copy of the lead because it contained NSA information from reports 
that included caveats ordering that the information not be shared ^vithout 
OIPR's permission. The agent asked "Jane" to get an opinion from the FBI's 
National Security Law Unit (NSLU) on whether he could open a criminal 
case on Mihdhar. ^o 

"Jane" sent an email to the Cole case agent explaining that according to the 
NSLU, the case could be opened only as an intelligence matter, and that if 
Mihdhar ^vas found, only designated intelligence agents could conduct or even 
be present at any interview. She appears to have misunderstood the complex 
rules that could apply to this situation. ^^ 

The FBI agent angrily responded: 

Whatever has happened to this — someday someone ^vill die — and wall 
or not — the public will not understand why we were not more effective 
and thro\ving every resource we had at certain "problems." 

Let's hope the National Security Law Unit will stand behind their 
decisions then, especially since the biggest threat to us now, UBL, is get- 
ting the most "protection." 

"Jane" replied that she was not making up the rules; she claimed that they 
were in the relevant manual and "ordered by the [FISA] Court and every office 
of the FBI is required to follow them including FBI NY."^^ 

It is now clear that everyone involved was confused about the rules govern- 
ing the sharing and use of information gathered in intelligence channels. 
Because Mihdhar was being sought for his possible connection to or knowl- 
edge of the Cole bombing, he could be investigated or tracked under the exist- 
ing Cole criminal case. No new criminal case was needed for the criminal agent 
to begin searching for Mihdhar. And as NSA had approved the passage of its 
information to the criminal agent, he could have conducted a search using all 
available information. As a result of this confusion, the criminal agents who 
were knowledgeable about al Qaeda and experienced with criminal investiga- 
tive techniques, including finding suspects and possible criminal charges, were 
thus excluded from the search. ^^ 

The search was assigned to one FBI agent, and it was his very first coun- 
terterrorism lead. Because the lead was "routine," he was given 30 days to open 
an intelligence case and make some unspecified efforts to locate Mihdhar. He 
started the process a few days later. He checked local New York databases for 
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criminal record and driver's license information and checked the hotel listed 
on Mihdhar's U.S. entry form. Finally, on September 11, the agent sent a lead 
to Los Angeles, because Mihdhar had initially arrived in Los Angeles in Janu- 
ary 2000.84 

We believe that if more resources had been applied and a significantly dif- 
ferent approach taken, Mihdhar and Haznii might have been found. They had 
used their true names in the United States. Still, the investigators would have 
needed luck as well as skill to find them prior to September 11 even if such 
searches had begun as early as August 23, when the lead was first drafted.^s 

Many FBI witnesses have suggested that even if Mihdhar had been found, 
there ^vas nothing the agents could have done except follow him onto the 
planes. We believe this is incorrect. Both Hazmi and Mihdhar could have been 
held for immigration violations or as material witnesses in the Cole bombing 
case. Investigation or interrogation of them, and investigation of their travel and 
financial activities, could have yielded evidence of connections to other par- 
ticipants in the 9/11 plot. The simple fact of their detention could have derailed 
the plan. In any case, the opportunity did not arise. 

Phoenix Memo 

The Phoenix memo ^vas investigated thoroughly by the Joint Inquiry and the 
Department ofjustice Inspector General.^* We will recap it briefly here. In July 
2001, an FBI agent in the Phoenix field office sent a memo to FBI headquar- 
ters and to two agents on international terrorism squads in the New York Field 
Office, advising of the "possibility of a coordinated effort by Usama Bin Ladin" 
to send students to the United States to attend civil aviation schools.The agent 
based his theory on the "inordinate number of individuals of investigative inter- 
est" attending such schools in Arizona. ^^ 

The agent made four recommendations to FBI headquarters: to compile a 
list of civil aviation schools, establish liaison with those schools, discuss his the- 
ories about Bin Ladin \vith the intelligence community, and seek authority to 
obtain visa information on persons applying to flight schools. His recommen- 
dations were not acted on. His memo was forwarded to one field office. Man- 
agers of the Usama Bin Ladin unit and the Radical Fundamentalist unit at FBI 
headquarters ^vere addressees, but they did not even see the memo until after 
September 11. No managers at headquarters saw the memo before September 
11, and the New York Field Office took no action. ^^ 

As its author told investigators, the Phoenix memo was not an alert about 
suicide pilots. His worry was more about a Pan Am Flight 103 scenario in 
which explosives were placed on an aircraft. The memo's references to aviation 
training were broad, including aeronautical engineering. *' If the memo had been 
distributed in a timely fashion and its recommendations acted on promptly, we 
do not believe it would have uncovered the plot. It might ^vell, however, have 
sensitized the FBI so that it might have taken the Moussaoui matter more seri- 
ously the next month. 
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Zacarias Moussaoui 

On August 15, 2001, the Minneapolis FBI Field Office initiated an intelligence 
investigation on Zacarias Moussaoui. As mentioned in chapter 7, he had entered 
the United States in February 2001, and had begun flight lessons at Airman 
Flight School in Norman, Oklahoma. He resumed his training at the Pan Am 
International Flight Academy in Eagan, Minnesota, starting on August 13. He 
had none of the usual qualifications for flight training on Pan Am s Boeing 747 
flight simulators. He said he did not intend to become a commercial pilot but 
wanted the training as an "ego boosting thing." Moussaoui stood out because, 
with little kno\¥ledge of flying, he wanted to learn how to "take off and land" 
a Boeing 747.90 

The agent in Minneapolis quickly learned that Moussaoui possessed jihadist 
beliefs. Moreover, Moussaoui had 132,000 in a bank account but did not pro- 
vide a plausible explanation for this sum of money. He had traveled to Pakistan 
but became agitated when asked if he had traveled to nearby countries while 
in Pakistan (Pakistan was the customary route to the training camps in 
Afghanistan). He planned to receive martial arts training, and intended to pur- 
chase a global positioning receiver. The agent also noted that Moussaoui 
became extremely agitated whenever he was questioned regarding his religious 
beliefs. The agent concluded that Moussaoui was "an Islamic extremist prepar- 
ing for some future act in furtherance of radical fundamentalist goals." He also 
believed Moussaoui's plan was related to his flight training. 'i 

Moussaoui can be seen as an al Qaeda mistake and a missed opportunity. 
An apparently unreliable operative, he had fallen into the hands of the FBI. As 
discussed in chapter 7, Moussaoui had been in contact with and received 
money from Ramzi Binalshibh. If Moussaoui had been connected to al 
Qaeda, questions should instantly have arisen about a possible al Qaeda plot 
that involved piloting airliners, a possibility that had never been seriously ana- 
lyzed by the intelligence community. 

The FBI agent who handled the case in conjunction with the INS repre- 
sentative on the Minneapolis Joint Terrorism Task Force suspected that Mous- 
saoui might be planning to hijack a plane. Minneapolis and FBI headquarters 
debated whether Moussaoui should be arrested immediately or surveilled to 
obtain additional information. Because it was not clear whether Moussaoui 
could be imprisoned, the FBI case agent decided the most important thing was 
to prevent Moussaoui from obtaining any further training that he could use to 
carry out a potential attack. ^2 

As a French national who had overstayed his visa, Moussaoui could be 
detained immediately The INS arrested Moussaoui on the immigration viola- 
tion. A deportation order was signed on August 17, 2001.93 

The agents in Minnesota were concerned that the U.S. Attorney s Office in 
Minneapolis ^vould find insufficient probable cause of a crime to obtain a crim- 
inal warrant to search Moussaoui's laptop computer.'^ Agents at FBI headquar- 
ters believed there ^vas insufficient probable cause. Minneapolis therefore 
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sought a special warrant under the Foreign Intelhgence Surveillance Act to 
conduct the search (we introduced FISA in chapter 3). 

To do so, however, the FBI needed to demonstrate probable cause that 
Moussaoui was an agent of a foreign po^ver, a demonstration that \vas not 
required to obtain a criminal warrant but ^vas a statutory requirement for a 
FISA warrant.''^ The case agent did not have sufficient information to connect 
Moussaoui to a "foreign power," so he reached out for help, in the United States 
and overseas. 

The FBI agent's August 18 message requested assistance from the FBI legal 
attache in Paris. Moussaoui had lived in London, so the Minneapolis agent 
sought assistance from the legal attache there as ^vell. By August 24, the Min- 
neapolis agent had also contacted an FBI detailee and a CIA desk officer at the 
Counterterrorist Center about the case.'*^ 

The FBI legal attache s office in Paris first contacted the French government 
on August 16 or 17, shortly after speaking to the Minneapolis case agent on 
the telephone. On August 22 and 27, the French provided information that 
made a connection between Moussaoui and a rebel leader in Chechnya, Ibn al 
Khattab. This set off a spirited debate bet^veen the Minneapolis Field Office, 
FBI headquarters, and the CIA as to whether the Chechen rebels and Khattab 
were sufficiently associated with a terrorist organization to constitute a "for- 
eign power" for purposes of the FISA statute. FBI headquarters did not believe 
this was good enough, and its National Security Law Unit declined to submit 
a FISA application.^^ 

After receiving the written request for assistance, the legal attache in Lon- 
don had promptly forwarded it to his counterparts in the British government, 
hand-delivering the request on August 21. On August 24, the CIA also sent a 
cable to London and Paris regarding "subjects involved in suspicious 747 flight 
training" that described Moussaoui as a possible "suicide hijacker." On August 
28, the CIA sent a request for information to a diflierent service of the British 
government; this communication ^varned that Moussaoui might be expelled 
to Britain by the end of August. The FBI office in London raised the matter 
briefly with British officials as an aside, after a meeting about a more urgent 
matter on September 3, and sent the British service a ^vritten update on Sep- 
tember 5. The case ^vas not handled by the British as a priority amid a large 
number of other terrorist-related inquiries. ^^ 

On September 4, the FBI sent a teletype to the CIA, the FAA, the Customs 
Service, the State Department, the INS, and the Secret Service summarizing 
the kno^vn facts regarding Moussaoui. It did not report the case agent's per- 
sonal assessment that Moussaoui planned to hijack an airplane. It did contain 
the FAA's comment that it was not unusual for Middle Easterners to attend 
flight training schools in the United States. '' 

Although the Minneapolis agents wanted to tell the FAA from the begin- 
ning about Moussaoui, FBI headquarters instructed Minneapolis that it could 
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not share the more complete report the case agent had prepared for the FAA. 
The Minneapohs supervisor sent the case agent in person to the local FAA 
office to fill in what he thought -were gaps in the FBI headquarters teletype. 10° 
No FAA actions seem to have been taken in response. 

There was substantial disagreement between Minneapolis agents and FBI 
headquarters as to what Moussaoui ^vas planning to do. In one conversation 
between a Minneapolis supervisor and a headquarters agent, the latter com- 
plained that Minneapolis 's FISA request was couched in a manner intended to 
get people "spun up." The supervisor replied that was precisely his intent. He 
said he ^vas "trying to keep someone from taking a plane and crashing into the 
World Trade Center." The headquarters agent replied that this was not going 
to happen and that they did not kno^v if Moussaoui ^vas a terrorist. ^'^^ 

There is no evidence that either FBI Acting Director Pickard or Assistant 
Director for Counterterrorism Dale Watson was briefed on the Moussaoui case 
prior to 9/11. Michael Rolince, the FBI assistant director heading the Bureau's 
International Terrorism Operations Section (ITOS), recalled being told about 
Moussaoui in two passing hall^vay conversations but only in the context that 
he might be receiving telephone calls from Minneapolis complaining about 
how headquarters was handling the matter. He never received such a call. 
Although the acting special agent in charge of Minneapolis called the ITOS 
supervisors to discuss the Moussaoui case on August 27, he declined to go up 
the chain of command at FBI headquarters and call Rolince. ^O- 

On August 23, DCl Tenet was briefed about the Moussaoui case in a brief- 
ing titled "Islamic Extremist Learns to Fly."i"3 Tenet was also told that Mous- 
saoui wanted to learn to fly a 747, paid for his training in cash, ^vas interested 
to learn the doors do not open in flight, and ^vanted to fly a simulated flight 
from London to New York. He was told that the FBI had arrested Moussaoui 
because of a visa overstay and that the CIA ^vas working the case \vith the FBI. 
Tenet told us that no connection to al Qaeda ^vas apparent to him at the time. 
Seeing it as an FBI case, he did not discuss the matter with anyone at the White 
House or the FBI. No connection \vas made between Moussaoui's presence in 
the United States and the threat reporting during the summer of 2001. 1°'* 

On September 1 1 , after the attacks, the FBI office in London renewed their 
appeal for information about Moussaoui. In response to U.S. requests, the 
British government supplied some basic biographical information about 
Moussaoui.The British government informed us that it also immediately tasked 
intelligence collection facilities for information about Moussaoui. On Septem- 
ber 13, the British government received ne^v, sensitive intelligence that Mous- 
saoui had attended an al Qaeda training camp in Afghanistan. It passed this 
intelligence to the United States on the same day. Had this information been 
available in late August 2001, the Moussaoui case ^vould almost certainly have 
received intense, high-level attention. 105 

The FBI also learned after 9/11 that the millennium terrorist Ressam, who 
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by 2001 was cooperating ^vith investigators, recognized Moussaoui as some- 
one who had been in the Afghan camps. lO'^ As mentioned above, before 9/11 
the FBI agents in Minneapolis had failed to persuade supervisors at headquar- 
ters that there was enough evidence to seek a FISA warrant to search Mous- 
saoui's computer hard drive and belongings. Either the British information or 
the Ressam identification would have broken the logjam. 

A maximum U.S. effort to investigate Moussaoui conceivably could have 
unearthed his connections to Binalshibh. Those connections might have 
brought investigators to the core of the 9/11 plot. The Binalshibh connection 
was recognized shortly after 9/11, though it ^vas not an easy trail to find. Dis- 
covering it ^vould have required quick and very substantial cooperation from 
the German government, ^vhich might ^vell have been difficult to obtain. 

However, publicity about Moussaoui s arrest and a possible hijacking threat 
might have derailed the plot. ^"^ With time, the search for Mihdhar and Hazmi 
and the investigation of Moussaoui might also have led to a breakthrough that 
would have disrupted the plot. 

Khalid Sheikh Mohammed 

Another late opportunity was presented by a confluence of information 
regarding Khalid Sheikh Mohammed received by the intelligence community 
in the summer of 2001. The possible links between KSM, Moussaoui, and an 
individual only later identified as Ramzi Binalshibh would remain undiscov- 
ered, ho^vever. 

Although we readily equate KSM with al Qaeda today, this was not the case 
before 9/11. KSM, who had been indicted injanuary 1996 for his role in the 
Manila air plot, was seen primarily as another freelance terrorist, associated 
with Ramzi Yousef Because the links between KSM and Bin Ladin or al 
Qaeda were not recognized at the time, responsibility for KSM remained in 
the small Islamic Extremist Branch of the Counterterrorist Center, not in the 
Bin Ladin unit. 

Moreover, because KSM had already been indicted, he became targeted 
for arrest. In 1997, the Counterterrorist Center added a Renditions Branch 
to help find wanted fugitives. Responsibility for KSM was transferred to this 
branch, which gave the CIA a "man-to-man" focus but was not an analyti- 
cal unit. When subsequent information came, more critical for analysis than 
for tracking, no unit had the job of following up on what the information 
might mean. 1 '^8 

For example, in September 2000, a source had reported that an individual 
named Khalid al-Shaykh al-Ballushi was a key lieutenant in al Qaeda. Al- 
Ballushi means "from Baluchistan," and KSM is from Baluchistan. Recogniz- 
ing the possible significance of this information, the Bin Ladin unit sought 
more information. When no information was forthcoming, the Bin Ladin unit 
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dropped the matCer.^o' When additional pieces of the puzzle arrived in the 
spring and summer of 2001, they were not put together. 

The first piece of the puzzle concerned some intriguing information asso- 
ciated with a person known as "Mukhtar" that the CIA had begun analyzing 
in April 2001. The CIA did not kno^v ^vho Mukhtar \vas at the time — only 
that he associated with al Qaeda lieutenant Abu Zubaydah and that, based on 
the nature of the information, he was evidently involved in planning possible 
terrorist activities, no 

The second piece of the puzzle was some alarming information regarding 
KSM. On June 12, 2001, a CIA report said that "Khaled" was actively recruiting 
people to travel outside Afghanistan, including to the United States ^vhere col- 
leagues were reportedly already in the country to meet them, to carry out 
terrorist-related activities for Bin Ladin. CIA headquarters presumed from the 
details of the reporting that this person \vas Khalid Sheikh Mohammed. In July, 
the same source ^vas shown a series of photographs and identified a photograph 
of Khalid Sheikh Mohammed as the Khaled he had previously discussed, m 

The final piece of the puzzle arrived at the CIA's Bin Ladin unit on August 
28 in a cable reporting that KSM's nickname was Mukhtar. No one made the 
connection to the reports about Mukhtar that had been circulated in the 
spring. This connection might also have underscored concern about the June 
reporting that KSM ^vas recruiting terrorists to travel, including to the United 
States. Only after 9/11 would it be discovered that Muhktar/KSM had com- 
municated \vith a phone that was used by Binalshibh, and that Binalshibh had 
used the same phone to communicate with Moussaoui, as discussed in chap- 
ter 7. As in the Moussaoui situation already described, the links to Binalshibh 
might not have been an easy trail to find and would have required substantial 
cooperation from the German government. But time was short, and running 
out. 112 

Time Runs Out 

As Tenet told us, "the system was blinking red" during the summer of 2001. 
Officials were alerted across the world. Many were doing everything they pos- 
sibly could to respond to the threats. 

Yet no one working on these late leads in the summer of 2001 connected 
the case in his or her in-box to the threat reports agitating senior officials and 
being briefed to the President. Thus, these individual cases did not become 
national priorities. As the CIA supervisor "John" told us, no one looked at the 
bigger picture; no analytic ^vork foresa^v the lightning that could connect the 
thundercloud to the ground. n^ 

We see little evidence that the progress of the plot was disturbed by any gov- 
ernment action. The U.S. government was unable to capitalize on mistakes 
made by al Qaeda. Time ran out. 



